Properties of Good Sessions

• Persistence

  The browser remembers the user's authentication, so they don't need to log in repeatedly

• Tamper Resistance

  Users cannot modify the session data to impersonate other users

• Sever-side Control

  Sessions can be invalidated on the server when necessary

  eg: in the event of security breach, account compromise, or a changing in account credentials

• Time-bounded

  Session should be expired after a reasonable time-period

• Revocable

  User should be able to terminate their own session

• Secure Transmission

  Session data should be protected from eavesdropping

• Multiple Sessions

  User should be able to maintain numerous active sessions

  eg: mobile, desktop